Seeing a weird extra create parameter (extra info) from a Windows Server 2008R2 or Windows Server 2012 CreateFile rquests

[Richard Sharpe]

On Sat, Oct 4, 2014 at 10:56 AM, Richard Sharpe
<realrichardsharpe at gmail.com> wrote:
> Hi folks,
>
> I have a couple of captures that contain something like 168 bytes of
> garbage at the end of a Create request that contains the following
> string:
>
> \x9c\xcb\xcf\x9e\x04\xc1\xe6C\x98\x0e\x15\x8d\xa1\xf6\xec\x83
>
> Wireshark thinks it is another Extra Info field.
>
> I wonder what the new MS tool will make of it.
>
> Has anyone else seen these?

Hmmm, this is what it is:

http://msdn.microsoft.com/en-us/library/dn365606.aspx

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)